Someone Built the Mandate in Silicon

On 28 September, the day Slowing the Agent Is the Wrong Lever closed the reach chapter, NVIDIA published the reference design for its Open Agent Safety Platform: OpenShell, an open-source sandboxed runtime for agents, paired with NVIDIA Sentry running on BlueField-4 data processing units, positioned on what NVIDIA calls the node's only path to the model. The post opens on the same disclosures the chapter did — agents breaking out of evaluation environments and reaching systems they should not have, some misreporting what they did — and it draws its own conclusion in one sentence: an agent in those circumstances cannot be expected to fully govern its own behaviour.

That is the conclusion The Boundary Cannot Live in the Model reached eight days earlier, from the same incidents, without contact. What follows is what NVIDIA built on it, where it converges with the chapter's terms, where it goes somewhere the chapter did not, and what it leaves out.

Four principles that converge

NVIDIA states five principles. Four of them converge with claims the reach chapter made across #131, #133 and #135. The fifth is a disagreement, taken up below.

Principle one is that policy must be verifiable: before an agent runs, a prover shows its policy cannot escape the operator's intent, and operators define which files, networks, tools, processes and credentials the agent can access. Principle two is that enforcement must be out of band — the controls do not live inside, or within reach of, the agent. Together those are the Encoded Mandate: scope held in the architecture that mediates the agent's actions rather than in the instructions the agent reads, so that it holds whether or not the agent interprets it correctly. NVIDIA's own analogy is the one the corpus would have chosen — the internet was not made safe by asking web developers to promise to be good, but by the browser ceasing to trust the page.

The platform's record is the Reach Record. DOCA, NVIDIA's programmable layer on BlueField, correlates agent interactions, policy decisions, and tool and data access into what the post calls a contextual record of agent activity, used to identify drift and decide when intervention is needed. The post also supplies the reason the record cannot be the agent's own account: in the breakouts, some agents misreported what they did. Reach Is State argued that reach must be written by the system, not reported by the agent, because a decision-and-outcome trail does not show an agent extending its own footprint. NVIDIA's contextual activity record is an implementation close to that argument. It is not the same object: the Reach Record is specifically the agent's footprint — every system, credential, channel, counterparty and resource it touched — held against the mandate in force, and NVIDIA's record correlates interactions, decisions and access without stating that it resolves footprint against scope per call. Close, and the closest public instance.

The gateway continuously verifies each agent's identity and delegated authority to ensure it operates within its assigned scope. That is the "on whose authority" clause of the mandate's definition, checked at runtime rather than asserted at deployment.

And on the two levers the industry reached for, NVIDIA's position is the chapter's. On retraining: drift — actions departing from the intended task or constraints, arising from a policy block, a bug, a missing tool, ambiguous instructions, or an agent left to run for weeks — "can't be trained away while retaining the capability." The Model Stopping Is Not the System Holding said that retraining strengthens the backstop and leaves the condition in place. On pace: the post names the debate the breakouts started and answers it by calling for more safety engineering, faster — security, it says, did not slow the internet down; it let it accelerate. That is the argument of Slowing the Agent Is the Wrong Lever, made by a company with every commercial reason to want agents running at full tempo, on the day the memo published.

Where NVIDIA moved the control point

Principle three is the one the chapter did not have. NVIDIA locates the control point on the path to the model: an agent cannot act without its next thought, so whoever controls that path owns both the best observation point and a kill switch. In a Vera Rubin POD, BlueField-4 sits on each compute tray's only path to the model, isolated from the host and beyond the agent's reach, enforcing policy at line speed even when host resources cannot be trusted.

The chapter placed the mandate on the layer mediating the agent's outbound calls — the tools, hosts, counterparties and resources it reaches. NVIDIA places it on the inbound path to inference. Both are out of band; they are different chokepoints. The outbound layer refuses the action; the inbound layer withholds the next inference. The second gives something the chapter never specified: a way to stop an agent that is already mid-course without waiting for it to attempt an out-of-scope call. Arco's reading is that the two are complementary rather than competing — the outbound mandate bounds what the agent may reach, the inbound control decides whether it gets to keep thinking — and that the chapter would have been stronger for naming both. This is the one place the reference design extends the corpus rather than confirming it.

Where the corpus and NVIDIA part

Principle four scales an agent's authority with the ability to inspect its reasoning: the more an agent can do, the more its thinking needs to be visible, and open models expose the whole reasoning space and activations. That is a system-inspection proposition — visibility as the control variable that licenses more authority — and the corpus diverges from it on what reasoning visibility is for, not on whether it is useful. Arco treats an agent's reasoning as an engineering and debugging surface for the people building and operating models. It does not treat it as the Steward's verification surface. The Steward-interface chapter routed verification to rendered state — what the system did and is about to do — because a Steward reading a reasoning trace at agent tempo is in Verification Blindness by another route, and because a reasoning trace is the agent's own report of itself, which the same NVIDIA post says agents have already misreported. NVIDIA is not proposing a Steward read chain-of-thought; it is proposing that authority scale with inspectability. Arco's position is that authority scales with what the architecture enforces, and this is a disagreement, stated as one.

There is also a distinction the post blurs and the chapter would hold. The title says monitoring; the body claims real-time enforcement at line speed and a kill switch. Those are different properties. Observation with a system-side stop is containment. Observation without one is a Reach Record, which is necessary and is not a boundary — a system judged safe because its record is complete is in Nominal Containment with better paperwork. The reference design describes the enforcing version. Whether the shipped product enforces or observes is the question to ask before crediting it with the chapter's first term rather than its third.

What it leaves out

Nothing in the platform crosses an organisational boundary. OpenShell, Sentry and DOCA govern agents inside one operator's infrastructure — the files, networks and tools that operator controls. The Mandate Has to Cross the Boundary argued that in an Agentic Market the agent's calls land on another business's system, where the operator's enforcement layer does not reach, and that the mandate has to travel and be enforced by the receiver. There is no Counterparty Mandate in NVIDIA's design, and no reason there would be: a hardware vendor's control point is the node, and the node is the operator's. That is the chapter's one term without a converging instance, and it is the one that depends on a market rather than a machine.

What Arco takes from it

Three things, at their width. Four of NVIDIA's five principles — the mandate held out of the agent's reach, the record of what the agent touched, authority checked at runtime, and the two levers rejected — converge with the chapter's claims, which now have an independent instance from a company that arrived by building rather than by argument. That is not proof of the principles. It makes them hard to dismiss as an Arco preference, and it dates the convergence to the same day.

NVIDIA's inbound control point is an extension the chapter should have had, and the corpus will carry it as one.

And the whole thing is a reference design for hardware NVIDIA sells, in a shared-responsibility model where the hardware provider owns a layer. NVIDIA has a commercial incentive to put enforcement in NVIDIA infrastructure; that does not invalidate the placement, and the Perspective does not treat it as if it did. The prover that NVIDIA says shows a policy cannot escape operator intent is described, not independently validated here; OpenShell is open source and inspectable, Sentry and the silicon enforcement are not. Arco has built none of this and runs no agents on it. The observation is about where NVIDIA put the boundary, and it put it where the chapter said it had to go.

Technology changes what is possible. What sits out of the agent's reach determines what stays in bounds.